output/20260723_081532/govviz/ALZ_20260723_081601/Enterprise-Scale/src/resources/Microsoft.Authorization/policySetDefinitions/Enforce-Guardrails-ContainerRegistry.json
|
{ "name": "Enforce-Guardrails-ContainerRegistry", "type": "Microsoft.Authorization/policySetDefinitions", "apiVersion": "2023-04-01", "scope": null, "properties": { "policyType": "Custom", "displayName": "Enforce recommended guardrails for Container Registry", "description": "This policy initiative is a group of policies that ensures Container Apps is compliant per regulated Landing Zones.", "metadata": { "version": "1.1.0", "category": "Container Registry", "source": "https://github.com/Azure/Enterprise-Scale/", "alzCloudEnvironments": [ "AzureCloud", "AzureChinaCloud", "AzureUSGovernment" ] }, "parameters": { "containerRegistryUnrestrictedNetworkAccess": { "type": "string", "defaultValue": "Deny", "allowedValues": [ "Audit", "Deny", "Disabled" ] }, "containerRegistryRepositoryToken": { "type": "string", "defaultValue": "Deny", "allowedValues": [ "Audit", "Deny", "Disabled" ] }, "containerRegistryModifyRepositoryToken": { "type": "string", "defaultValue": "Modify", "allowedValues": [ "Modify", "Disabled" ] }, "containerRegistryLocalAuth": { "type": "string", "defaultValue": "Deny", "allowedValues": [ "Audit", "Deny", "Disabled" ] }, "containerRegistryModifyLocalAuth": { "type": "string", "defaultValue": "Modify", "allowedValues": [ "Modify", "Disabled" ] }, "containerRegistryExports": { "type": "string", "defaultValue": "Deny", "allowedValues": [ "Audit", "Deny", "Disabled" ] }, "containerRegistryAnAuth": { "type": "string", "defaultValue": "Deny", "allowedValues": [ "Audit", "Deny", "Disabled" ] }, "containerRegistryModifyAnAuth": { "type": "string", "defaultValue": "Modify", "allowedValues": [ "Modify", "Disabled" ] }, "containerRegistrySkuPrivateLink": { "type": "string", "defaultValue": "Deny", "allowedValues": [ "Audit", "Deny", "Disabled" ] }, "containerRegistryArmAudience": { "type": "string", "defaultValue": "Deny", "allowedValues": [ "Audit", "Deny", "Disabled" ] }, "containerRegistryModifyArmAudience": { "type": "string", "defaultValue": "Modify", "allowedValues": [ "Modify", "Disabled" ] }, "containerRegistryModifyPublicNetworkAccess": { "type": "string", "defaultValue": "Modify", "allowedValues": [ "Modify", "Disabled" ] } }, "policyDefinitions": [ { "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/79fdfe03-ffcb-4e55-b4d0-b925b8241759", "policyDefinitionReferenceId": "Modify-ContainerRegistry-Local-Auth", "definitionVersion": "1.*.*", "groupNames": [], "parameters": { "effect": { "value": "[[parameters('containerRegistryModifyLocalAuth')]" } } }, { "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/a9b426fe-8856-4945-8600-18c5dd1cca2a", "policyDefinitionReferenceId": "Modify-ContainerRegistry-Repo-Token", "definitionVersion": "1.*.*", "groupNames": [], "parameters": { "effect": { "value": "[[parameters('containerRegistryModifyRepositoryToken')]" } } }, { "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/42781ec6-6127-4c30-bdfa-fb423a0047d3", "policyDefinitionReferenceId": "Deny-ContainerRegistry-Arm-Audience", "definitionVersion": "1.*.*", "groupNames": [], "parameters": { "effect": { "value": "[[parameters('containerRegistryArmAudience')]" } } }, { "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/785596ed-054f-41bc-aaec-7f3d0ba05725", "policyDefinitionReferenceId": "Modify-ContainerRegistry-Arm-Audience", "definitionVersion": "1.*.*", "groupNames": [], "parameters": { "effect": { "value": "[[parameters('containerRegistryModifyArmAudience')]" } } }, { "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/bd560fc0-3c69-498a-ae9f-aa8eb7de0e13", "policyDefinitionReferenceId": "Deny-ContainerRegistry-Sku-PrivateLink", "definitionVersion": "1.*.*", "groupNames": [], "parameters": { "effect": { "value": "[[parameters('containerRegistrySkuPrivateLink')]" } } }, { "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/cced2946-b08a-44fe-9fd9-e4ed8a779897", "policyDefinitionReferenceId": "Modify-ContainerRegistry-Anonymous-Auth", "definitionVersion": "1.*.*", "groupNames": [], "parameters": { "effect": { "value": "[[parameters('containerRegistryModifyAnAuth')]" } } }, { "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/9f2dea28-e834-476c-99c5-3507b4728395", "policyDefinitionReferenceId": "Deny-ContainerRegistry-Anonymous-Auth", "definitionVersion": "1.*.*", "groupNames": [], "parameters": { "effect": { "value": "[[parameters('containerRegistryAnAuth')]" } } }, { "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/524b0254-c285-4903-bee6-bb8126cde579", "policyDefinitionReferenceId": "Deny-ContainerRegistry-Exports", "definitionVersion": "1.*.*", "groupNames": [], "parameters": { "effect": { "value": "[[parameters('containerRegistryExports')]" } } }, { "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/dc921057-6b28-4fbe-9b83-f7bec05db6c2", "policyDefinitionReferenceId": "Deny-ContainerRegistry-Local-Auth", "definitionVersion": "1.*.*", "groupNames": [], "parameters": { "effect": { "value": "[[parameters('containerRegistryLocalAuth')]" } } }, { "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/ff05e24e-195c-447e-b322-5e90c9f9f366", "policyDefinitionReferenceId": "Deny-ContainerRegistry-Repo-Token", "definitionVersion": "1.*.*", "groupNames": [], "parameters": { "effect": { "value": "[[parameters('containerRegistryRepositoryToken')]" } } }, { "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/d0793b48-0edc-4296-a390-4c75d1bdfd71", "policyDefinitionReferenceId": "Deny-ContainerRegistry-Unrestricted-Network-Access", "definitionVersion": "2.*.*", "groupNames": [], "parameters": { "effect": { "value": "[[parameters('containerRegistryUnrestrictedNetworkAccess')]" } } }, { "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/a3701552-92ea-433e-9d17-33b7f1208fc9", "policyDefinitionReferenceId": "Modify-ContainerRegistry-Public-Network-Access", "definitionVersion": "1.*.*", "groupNames": [], "parameters": { "effect": { "value": "[[parameters('containerRegistryModifyPublicNetworkAccess')]" } } } ], "policyDefinitionGroups": null } } |